Ministers are to be called to a consultation after the CPR leak. Experts are in no doubt about what they would do.

Ministers to be summoned for consultation after CPR leak. Experts are in no doubt about what they would do.

We must face the fact that the system can no longer be used to confirm identity, say two experts.

Earlier this month, 8.8 million CPR numbers from living and deceased Danes were stolen. Today, two ministers will be summoned for consultation on the matter. (Photo: © Graphics: Søren Winther Nørbæk DR)

By Laura Kirkebæk-Johansson ([email protected]) 37 minutes ago

It no longer makes sense to use the CPR number to confirm your identity at the pharmacy or when taking out a loan.

That is the message from two experts, after 8.8 million CPR numbers were stolen earlier this month.

- Fundamentally, we must acknowledge that the CPR number is compromised. And this case is just the final nail in the coffin, says Jacob Herbst, chair of the Cybersecurity Council.

Read also: How the CPR data breach was discovered: 'It's quite shocking'

He is supported by Jan Kaastrup, digital investigator at the cybersecurity company CSIS. He believes we should bury the old perception of the CPR system.

- This perception that we have a secret number that we can use to authenticate ourselves at the doctor's, at the pharmacy, when we get a fine from DSB or take out a quick loan – we simply need to find other solutions for that, he says.

-----------------------------

Identify and authenticate

-----------------------------

*Identify* means to state who you are.

*Authenticate* means to check and confirm whether the identity is actually correct, thereby granting, for example, a user access to a computer system or similar.

Source: The Danish Dictionary

Later today, the Danish Parliament's Business and Digitalisation Committee has summoned Digitalisation Minister Christina Egelund (M) and Minister for Societal Security and Emergency Management Lisbeth Bech-Nielsen (SF) for consultation about the CPR leak.

Here, the ministers must, among other things, address whether the case "gives cause to rethink the digital infrastructure and the use of the CPR system".

---------------

Between two stools

---------------

After the latest leak, the CPR number has ended up somewhat between two stools, says Jacob Herbst.

On one hand, the number contains personal information about date of birth and gender, and therefore it cannot simply be made freely available.

- But on the other hand, we must also acknowledge that it is compromised. So it may not make much sense to spend a huge amount of resources on protecting it going forward, he says.

Listen to Jacob Herbst elaborate here:

The Cybersecurity Council proposes a ban on using the CPR number as a means of authentication. Tools like MitID and the new AltID are better, it says.

Going forward, the CPR number should only be considered an identification number, believes Jacob Herbst. That is, a way to, for example, tell the difference between two people who are both named Jens Hansen.

If the system is to be completely rethought, Jan Kaastrup would suggest creating a unique number for all residents in Denmark that does not contain personally sensitive information. And he agrees that a different tool, such as MitID, should be used for authentication.

- We still need a number that can identify us. We can't really do without that, he says.

The consultation is scheduled to begin at 12:00.

Here are five things your CPR number can be (mis)used for

Warning: This article was translated by a Large Language Model, in case of doubt, you can always visit the original source.